Selective Heuristic Exemption Revocation for Signed Applications

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security software systems face challenges in selectively revoking heuristic exemptions for applications with digital signatures, particularly when the signature provider is not trusted, as they may distribute malicious software, leading to potential false exemptions.

Innovation Solution

An exemption manager examines digital signatures for specific attributes to determine if heuristic detection exemptions should be revoked, subjecting applications with certain attributes to standard heuristic detection, thereby scrutinizing them for malicious behavior without assuming they are malicious.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If heuristic detection exemption is granted to all applications with digital signatures, then false positives are reduced and trusted third party applications can bypass heuristic detection, but applications from untrusted signature providers may be incorrectly exempted from security scanning

Engineering Contradiction:

Improveaccuracy of heuristic detection exemptionVSAvoidcomplexity of exemption management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies local quality by differentiating the treatment of digitally signed applications based on their specific attributes. Instead of uniformly exempting all signed applications, the system examines individual signature attributes (publisher identity, product name, version, etc.) to determine which applications deserve exemption and which should be scanned. This allows legitimate applications to be exempted while untrusted applications are scrutinized, resolving the contradiction between reducing false positives and preventing malicious exemptions.

Inventive Principle:

Principle #3Local quality

2Object-affected harmful factors

If heuristic detection exemption is revoked for applications from companies known to distribute spyware, then security is improved, but legitimate applications from the same company may be incorrectly flagged as malicious

Engineering Contradiction:

Improvesecurity threat from malicious applicationsVSAvoidfalse positives against legitimate applications

Core Design Contradiction:

Object-affected harmful factorsVSObject-generated harmful factors

Solution Approach 1:

The patent segments the population of digitally signed applications into different categories based on their signature attributes. By examining specific attributes such as publisher identity, product name, and version information, the system can identify and segment malicious applications from legitimate ones, even when they share the same publisher. This allows the system to revoke exemptions only for malicious applications while preserving exemptions for legitimate applications, thus resolving the contradiction between improving security and reducing false positives.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system changes the parameters used for exemption determination by examining multiple signature attributes rather than relying solely on the presence of a digital signature. By analyzing combinations of attributes (publisher, product, version, etc.), the system can dynamically adjust which applications receive exemptions, allowing it to revoke exemptions for malicious applications while maintaining them for legitimate ones, thereby resolving the security versus false positive contradiction.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If all applications are subjected to heuristic detection, then malicious behavior is detected, but processing time increases and legitimate applications are slowed down

Engineering Contradiction:

Improvedetection of malicious behaviorVSAvoidprocessing time for application execution

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by examining digital signature attributes before executing heuristic detection. The system pre-evaluates applications based on their signature attributes and makes an upfront determination about whether they should be exempted from heuristic scanning. This preliminary classification allows legitimate applications to bypass time-consuming heuristic detection, reducing processing time, while ensuring that potentially malicious applications are identified for scanning, maintaining detection reliability.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8826034B1Selective revocation of heuristic exemption for content with digital signatures

Publication Date: 2014.09.02 CA TECH INC

AI summary

Digital signatures are examined for specified attributes indicating that an exemption is not appropriate. If the specified attributes are not present in a digital signature, the associated application will be exempt from heuristic detection. However, where the specified attributes are present in a signature, the signed application is subject to heuristic detection just like a non-signed application. This does not mean the application is automatically treated as being malicious, but simply that the application is scrutinized to check for malicious behavior.